Behavioral task
behavioral1
Sample
7560d8adb10118c60ab36f8956b8b1d6d2c315adcdb24ddbf0fb0ea1b7f3c5ef.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7560d8adb10118c60ab36f8956b8b1d6d2c315adcdb24ddbf0fb0ea1b7f3c5ef.exe
Resource
win10v2004-20240226-en
General
-
Target
7560d8adb10118c60ab36f8956b8b1d6d2c315adcdb24ddbf0fb0ea1b7f3c5ef
-
Size
163KB
-
MD5
20ecf8fc3b50bc16425ea35e235f326f
-
SHA1
328013cf9806f91ffff988d84dadaeef8d06cfec
-
SHA256
7560d8adb10118c60ab36f8956b8b1d6d2c315adcdb24ddbf0fb0ea1b7f3c5ef
-
SHA512
dd2911344f6a929e32d4bf849019520b36e6ab9f04d7414cf7b110ff65a42e25ee30dd6cd25a2e942c3a51eb9d69a1d11c3db06b6de50978cb38af48b2daa800
-
SSDEEP
3072:ig+tbTibcFOxlPBz65/M6If+3Js+3JFkKeTno:kkbFPxBt25
Malware Config
Extracted
xworm
guest-punishment.gl.at.ply.gg:20781
-
Install_directory
%AppData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule sample family_xworm -
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Xworm family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7560d8adb10118c60ab36f8956b8b1d6d2c315adcdb24ddbf0fb0ea1b7f3c5ef
Files
-
7560d8adb10118c60ab36f8956b8b1d6d2c315adcdb24ddbf0fb0ea1b7f3c5ef.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ